CVE-2026-87486 in Chrome
Summary
by MITRE • 09/09/2026
Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as Clickjacking within Trusted Web Activities in Google Chrome for Android represents a significant interface manipulation flaw that exploits the trust relationship between native applications and web content rendered by the browser engine. Prior to version 153.0.8010.36, the implementation of Trusted Web Activities failed to adequately isolate the visual presentation layer from malicious user interactions initiated by co-installed applications on the same device. This architectural weakness allows a local attacker, leveraging an application installed alongside Chrome, to overlay deceptive UI elements over legitimate browser interfaces. The core technical flaw lies in the insufficient handling of touch events and window focus management when transitioning between native app contexts and web-based Trusted Web Activity sessions. By exploiting this gap, an adversary can trick users into interacting with hidden or misaligned buttons, effectively bypassing standard security boundaries that rely on user intent verification through clear visual feedback.
From a technical perspective, the vulnerability stems from how Chrome manages the overlay hierarchy during Trusted Web Activities. When a web page is launched via a Trusted Web Activity, it runs in an environment designed to mimic a native app experience, often removing traditional browser chrome such as the address bar and navigation controls to provide a seamless user interface. However, this removal of visual anchors creates ambiguity regarding which application context is currently active or what action will be performed upon interaction. A malicious co-installed app can exploit this by injecting overlays that capture touch events intended for legitimate UI elements within the web view. This mechanism allows the attacker to spoof the address bar and other critical interface components, making it appear as though the user is interacting with a trusted domain while actually triggering actions on an untrusted or different target. The severity of this issue is classified as Medium by Chromium security standards because it requires local access and co-installation but can lead to significant social engineering success rates due to the high trust users place in browser interfaces.
The operational impact of this vulnerability extends beyond simple interface spoofing, potentially facilitating account takeover, unauthorized financial transactions, or credential harvesting if combined with phishing techniques. An attacker could craft a scenario where a user believes they are confirming a payment on their banking app via Chrome but is instead authorizing a transfer to the attacker’s account due to the manipulated UI overlay. Similarly, users might be tricked into granting permissions or entering sensitive data under false pretenses because the address bar spoofing obscures the true destination of the web activity. This erosion of user trust in browser-based interactions undermines the security model that relies on visual cues for authentication and authorization decisions. The ability to manipulate these interfaces locally means that even users with strong password hygiene may fall victim if they do not carefully verify domain names, which becomes increasingly difficult when the address bar itself is compromised or obscured by malicious overlays.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, where these issues have been addressed through improved isolation of touch event handling and stricter enforcement of UI boundaries in Trusted Web Activities. Developers utilizing the Android platform should also ensure that their applications do not request unnecessary permissions that could facilitate overlay attacks, such as display over other apps without proper user consent mechanisms. Security awareness training remains critical; users must be educated to verify domain names manually even when using trusted browser interfaces and to remain cautious of unexpected UI changes or overlays during sensitive transactions. From a standards perspective, this vulnerability aligns with CWE-1021 Improper Restriction of Rendered UI Layers or Frames, which describes flaws where an attacker can manipulate the presentation layer to deceive users. It also relates to ATT&CK technique T1537 Deceptive Communication Channel, as it involves creating a misleading interface to facilitate further attacks such as credential theft or unauthorized actions. Continuous monitoring for similar patterns in other browser engines and mobile operating systems is recommended to prevent analogous exploits across different platforms.